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DETAILED ACTION 

1 . This action is responding to application papers filed 9-11-2003. 

2. Claims 1 - 37 are pending. Claims 1, 7, 15, 16, 23, 24, 29, 30 are independent. 

Claim Rejections - 35 USC §102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102(b) 
that form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

4. Claims 1 - 4, 7 - 10, 14, 16 - 19, 24 - 26, 29 - 33, 37 are rejected under 35 
U.S.C. 102(b) as being anticipated by Timson et al. (US Patent No. 6,041,412). 

Regarding Claims 1, 7, 24, 29, Timson discloses a method for providing an access 
candidate access to secured electronic data, the method comprising the steps of: 

a) submitting a request for access candidate access to the secured electronic data 
to a controller associated with the secured electronic data; (see Timson col. 3, 
lines 34-40; col. 3, lines 57-64: request processing (i.e request submitted and 
processed)) 

b) comparing, at the controller, one or more attributes of the access candidate with 
one or more access requirements associated with the secured electronic data; 
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(see Timson col. 2, lines 50-59: attributes; col. 3, lines 11-16: determine (i.e. 
comparing), enable access) 

c) submitting, by the controller, a request for authorization to a resolution authority 
when the comparison indicates that access by the access candidate is prohibited 
without authorization; (see Timson col. 3, lines 34-40; col. 3, lines 57-64: request 
processing, resolution authority; col. 2, lines 50-59: attributes; col. 4, lines 7-11: 
access determination required for access (i.e. prohibited without authorization)) 
and ; 

d) granting the access candidate access to the secured electronic data when the 
resolution authority provides authorization for such access, (see Timson col. 4, 
lines 7-11: access enabled (i.e. granted)) 

Regarding Claims 2, 8, 17, 25, 31, Timson discloses the method as in Claims 1, 8, 16, 
24, 30, further comprising the step of granting the access candidate access to the 
secured electronic data when the comparison indicates that access by the access 
candidate is not prohibited, (see Timson col. 4, lines 7-11: access enabled (i.e. 
granted), not prohibited) 

Regarding Claims 3, 9, 18, 32, Timson discloses the method as in Claims 2, 7, 16, 30, 
further comprising the step of denying the access candidate access to the secured 
electronic data when the resolution authority denies authorization, (see Timson col. 3, 
lines 28-32; col. 4, lines 11-15: access denied) 
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Regarding Claims 4, 10, 19, 26, 33, Timson discloses the method as in Claims 1, 7, 
16, 24, 30, wherein one or more access requirements are represented as part of a 
graphical display associated with the access candidate and accessed for display to the 
controller via a network, (see Timson col. 5, lines 26-35: display capability for user 
interface information) 

Regarding Claims 14, 37, Timson discloses the method as in Claims 7, 30, wherein at 
least one of the request for access to the first security level and the request for access 
to the second security level is submitted by one or more sponsors, (see Timson col. 14, 
lines 13-20: request, 1st level security; col. 14, lines 25-35: request processing, 2nd 
level security) 

> Regarding Claim 16, Timson discloses a system for providing an access candidate 
access to secured electronic data, the system comprising: 

a) storage adapted to receive and store the electronic data; (see Timson col. 18, 
lines 9-12; col. 18, lines 18-21: storage capability for accessible data) 

b) one or more resources adapted to access and manipulate the electronic data; 
(see Timson col. 2, lines 31-34; col. 2, lines 40-41: interrogatable and enabling 
modules, resources to access and manipulate data) 

c) means for evaluating a request for access candidate access to the one or more 
resources the evaluation of the request including a first comparison of one or 
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more attributes of the access candidate with one or more access requirements 
associated with the one or more resources; (see Timson col. 5, lines 5-13: 
software means; col. 2, lines 50-59: attributes; col. 3, lines 34-40; col. 3, lines 57- 
64: request processing, evaluation to enable access) 

d) means for granting the access candidate access to the one or more resources 
when the first comparison indicates that access is not prohibited; (see Timson 
col. 5, lines 5-13: software means; col. 4, lines 7-11: access enabled (i.e. 
granted)) 

e) means for evaluating a request for access candidate access to the electronic 
data by the one or more resources, the evaluation of the request including a 
second comparison of one or more attributes of the access candidate with one or 
more access requirements associated with the electronic data; (see Timson col. 
5, lines 5-13: software means; col. 2, lines 31-34; col. 2, lines 40-41: 
interrogatable and enabling modules, resources to access and manipulate data) 

f) means for submitting a request for authorization to a resolution authority when 
the second comparison indicates that access to the electronic data by the access 
candidate is prohibited without authorization; (see Timson col. 5, lines 5-13: 
software means; col. 3, lines 34-40; col. 3, lines 57-64: request processing, must 
be authorized to access data) and 

g) means for granting the access candidate access to the electronic data using the 
one or more resources when the resolution authority provides authorization, (see 
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Timson col. 5, lines 5-13: software means; col. 3, lines 28-32; col. 4, lines 11-15: 
access enabled (i.e. granted)) 

Regarding Claim 30, Timson discloses in a data security system having a first security 
level securing one or more resources for manipulating electronic data and a second 
security level securing access to the electronic data by the one or more resources, a 
method for determining an access candidate's access to the electronic data, the method 
comprising the steps of: 

a) submitting a request for access to the first security level; (see Timson col. 3, 
lines 34-40: request processing (i.e. submitted and processed)) 

b) determining the access candidate's access to the first security level based on a 
comparison of one or more attribute: of the access candidate with one or more 
access requirements associated with the first security level; (see Timson col. 14, 
lines 13-20: 1st security level processing) 

c) submitting a request for access to the second security level; (see Timson col. 3, 
lines 34-40; col. 3, lines 57-64: request processing (i.e. submitted and 
processed)) and 

d) submitting a request for authorization to a resolution authority when a 
comparison of one or more attributes of the access candidate with one or more 
access requirements associated with the second security level indicates that 
access to the second security level by the access candidate is prohibited without 
authorization and determining by the resolution authority the access candidate's 
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access to the second security level, (see Timson col. 3, lines 34-40; col. 3, lines 
57-64: request processing; col. 14, lines 25-35: 2nd security level processing) 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 5, 6, 11 - 13, 15, 20 - 23, 27, 28, 34 - 36 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Timson in view of Orsini et al. (US Patent 
No. 20040049687). 

Regarding Claims 5, 11, 13, 27, Timson discloses the method as in Claims 1, 7, 24, 
wherein one or more access requirements, (see Timson col. 2, lines 50-59; col. 2, lines 
41-49: attributes, permissions; col. 3, lines 34^40: required to access resources) 
Timson does not specifically disclose one or more access requirements related to at 
least one of a citizenship status of the access candidate and a current location of the 
access candidate. However, Orsini discloses wherein one or more access 
requirements are related to at least one of a citizenship status of the access candidate 
and a current location of the access candidate, (see Orsini paragraph [0013], lines 1-3; 
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paragraph [0060], lines 4-13: management of secure data, parameters (i.e. attributes) 
agreement, location information) 

It would have been obvious to one of ordinary skill in the art to modify Timson as 
taught by Orsini to enable one or more access requirements related to at least one of a 
citizenship status of the access candidate and a current location of the access 
candidate. One of ordinary skill in the art would have been motivated to employ the 
teachings of Orsini in order to enable a relatively fast, secure, and efficient 
authentication of data streams, (see Orsini paragraph [0012], lines 1-3: * ... Based on 
the foregoing, a need exists to provide a cryptographic system whose security is user- 
independent while still supporting mobile users. . . . "; paragraph [001 3], lines 1-3: 
Accordingly, one aspect of the present invention is to provide a method for securing 
virtually any type of data from unauthorized access or use. ... ") 

Regarding Claims 6, 12, 22, 28, 36, Timson discloses the method as in Claims 5, 1 1 , 
16, 27, 30, wherein one or more attributes of the access candidate, (see Timson col. 2, 
lines 50-59: permissions, attributes for requestor (i.e. access candidate); col. 3, lines 34- 
40: required to access resources) Timson does not specifically disclose one or more 
attributes relate to at least one of a citizenship status of the access candidate and a 
current location of the access candidate. However, Orsini discloses wherein one or 
more attributes of the access candidate relate to at least one of a citizenship status of 
the access candidate and a current location of the access candidate, (see Orsini 
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paragraph [0013], lines 1-3; paragraph [0060], lines 4-13: management of secure data, 
parameters (i.e. attributes) agreement, location information) 

It would have been obvious to one of ordinary skill in the art to modify Timson as 
taught by Orsini to enable one or more attributes related to at least one of a citizenship 
status of the access candidate and a current location of the access candidate. One of 
ordinary skill in the art would have been motivated to employ the teachings of Orsini in 
order to enable a relatively fast, secure, and efficient authentication of data streams, 
(see Orsini paragraph [0012], lines 1-3; paragraph [0013], lines 1-3) 

Regarding Claim 15, Timson discloses in a data security system having a first security 
level securing one or more resources for manipulating electronic data and a second 
security level securing the electronic data, a method for providing an access candidate 
access to the electronic data, the method comprising the steps of: 

a) identifying a plurality of data subsets of the electronic data; (see Timson col. 6 

lines 43-46; multiple data sets and data records (i.e. a plurality of datasets)) 
d) granting the access candidate access to the first security level based at least in 
part on an evaluation of the request for access to the first level; ((see Timson 
col. 14, lines 13-20: request, 1st level security) 
g) granting the access candidate access to the requested at least one data subset 
at the second security level when the resolution authority provides authorization 
upon receipt of the request for authorization, (see Timson col. 14, lines 25-35: 
request, 2nd level security; col. 4, lines 7-11: access enabled (i.e. granted)) 
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Timson discloses wherein a request (seeTimson col. 3, lines 34-40; col. 3, lines 57- 
64: request processing; col. 2, lines 56-59; col. 17, lines 4-11: country attribute), and 
determining, for each data subset, at least one data class associated with the data 
subset (see Timson col. 2, lines 50-59: one data class or attributes of a class), and 
submitting, by a first sponsor of the access candidate, a request for access to the 
first security level (see Timson col. 3, lines 34-40: request processing; col. 2, lines 
56-59; col. 17, lines 4-11: country attribute, requestor attributes; col. 14, lines 13-20: 
request, 1st level security), and a second sponsor of the access candidate, a 
request for access to at least one data subset at the second security level when 
access to the first security level has been granted (see Timson col. 14, lines 25-35: 
request, 2nd level security), and a request for authorization to a resolution authority 
when a comparison of the at least one data class of the requested data subset 
indicates that access to a requested data subset at the second level by the access 
candidate is prohibited without authorization, (see Timson col. 3, lines 34-40: 
permissions required to access data) Timson does not specifically disclose an 
indication of a citizenship status of the access candidate, an indication of a current 
location of the access candidate, and an indication of an existence of a data access 
agreement with the access candidate. 
However, Orsini discloses: 

b) at least a citizenship requirement and a location requirement for access to data 
associated with the data class; (see Orsini paragraph [0013], lines 1-3; 
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paragraph [0060], lines 4-13: management of secure data, parameters (i.e. 
attributes) agreement, location information) 
c) an indication of a citizenship status of the access candidate, an indication of a 
current location of the access candidate, and an indication of an existence of a 
data access agreement with the access candidate; (see Orsini paragraph [0013], 
lines 1-3; paragraph [0060], lines 4-13: management of secure data, parameters 
(i.e. attributes) agreement, location information, citizenship information) 

e) an indication of a citizenship status of the access candidate and an indication of a 
current location of the access candidate; (see Orsini paragraph [0013], lines 1-3; 
paragraph [0060], lines 4-13: management of secure data, parameters (i.e. 
attributes) agreement, location information) 

f) citizenship status and the current location of the access candidate with the 
respective citizenship requirement and location requirement; (see Orsini 
paragraph [0013], lines 1-3; paragraph [0060], lines 4-13: management of secure 
data, parameters (i.e. attributes) agreement, location information) 

It would have been obvious to one of ordinary skill in the art to modify Timson 
as taught by Orsini to enable the request including an indication of a citizenship 
status of the access candidate, an indication of a current location of the access 
candidate, and an indication of an existence of a data access agreement with the 
access candidate. One of ordinary skill in the art would have been motivated to 
employ the teachings of Orsini in order to enable a relatively fast, secure, and 
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efficient authentication of data streams, (see Orsini paragraph [0012], lines 1-3; 
paragraph [0013], lines 1-3) 

Regarding Claim 20, Timson discloses the system as in Claim 16, wherein one or 
more access requirements associated with the one or more resources related, (see 
Timson col. 3, lines 34-40; col. 3, lines 57-64: request processing; col. 2, lines 56-59; 
col. 17, lines 4-1 1 : country information, attributes) Timson does not specifically 
disclose at least one of: a valid data access agreement with a potential access 
candidate; a current location of the potential access candidate; and a citizenship status 
of the potential access candidate. However, Orsini discloses wherein at least one of: a 
valid data access agreement with a potential access candidate; a current location of the 
potential access candidate; and a citizenship status of the potential access candidate, 
(see Orsini paragraph [0013], lines 1-3; paragraph [0060], lines 4-13: management of 
secure data, parameters (i.e. attributes) agreement, location information) 

It would have been obvious to one of ordinary skill in the art to modify Timson as 
taught by Orsini to enable at least one of: a valid data access agreement with a 
potential access candidate; a current location of the potential access candidate; and a 
citizenship status of the potential access candidate. One of ordinary skill in the art 
would have been motivated to employ the teachings of Orsini in order to enable a 
relatively fast, secure, and efficient authentication of data streams, (see Orsini 
paragraph [0012], lines 1-3; paragraph [0013], lines 1-3) 
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Regarding Claims 21, 34, 35, Timson discloses the system as in Claims 20, 30, 34, 
wherein one or more access candidate attributes, (see Timson col. 2, lines 50-56: 
attributes; col. 2, lines 56-59; col. 17, lines 4-11: country attribute, resource access) 
Timson does not specifically disclose at least one of: an indication of an existence of a 
data access agreement with the access candidate; a current location of the access 
candidate; and a citizenship status of the access candidate. However, Orsini discloses 
wherein at least one of: an indication an existence of a data access agreement with the 
access candidate; a current location of the access candidate; and a citizenship status of 
the access candidate, (see Orsini paragraph [0013], lines 1-3; paragraph [0060], lines 
4-13: management of secure data, parameters (i.e. attributes) agreement, location 
information) 

It would have been obvious to one of ordinary skill in the art to modify Timson as 
taught by Orsini to enable at least one of: an indication an existence of a data access 
agreement with the access candidate; a current location of the access candidate; and a 
citizenship status of the access candidate. One of ordinary skill in the art would have 
been motivated to employ the teachings of Orsini in order to enable a relatively fast, 
secure, and efficient authentication of data streams, (see Orsini paragraph [0012], 
lines 1-3; paragraph [0013], lines 1-3) 

Regarding Claim 23, Timson discloses a system for providing an access candidate 
access to secured electronic data, the electronic data being associated with one or 
more data classes, each data class identifying at least a citizenship requirement and a 
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location requirement for access to data associated with the data class, the system 
comprising: 

a) storage adapted to receive and store the electronic data; (see Timson col. 18, 
lines 9-12; col. 18, lines 18-21: storage capability, data, information) 

b) one or more resources adapted to process and manipulate the electronic data; 
(see Timson col. 2, lines 31-34; col. 2, lines 40-41: interrogatable and enabling 
modules, resources to process and manipulate data) 

e) one or more resolution authorities adapted to authorize access to one or more 
portions of the electronic data when a comparison performed by a corresponding 
data access controller indicates access is prohibited without authorization; (see 
Timson col. 2, lines 31-34; col. 2, lines 40-41: interrogatable and enabling 
modules, resources (i.e. resolution authorities) to control access and manipulate 
data; col. 3, lines 34-40: authorization required to access data) and 

f) a data access module adapted to: evaluate a request for access to one or more 
portions of the electronic data by the one or more resources to identify one or 
more data access controllers corresponding to the one or more portions of the 
electronic data; (see Timson col. 3, lines 34-40; col. 3, lines 57-64: request 
processing; col. 2, lines 31-34; col. 2, lines 40-41: interrogatable and enabling 
modules, resources (i.e. controllers) to enable (i.e. grant) access to data)) and 

g) forward the request for access to the one or more identified data access 
controllers for evaluation as to whether to grant the access candidate access to 
the corresponding one or more portions of the electronic data, (see Timson col. 
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3, lines 34-40; col. 3, lines 57-64: request processing (i.e. submit, forward 
request for processing); col. 2, lines 31-34; col. 2, lines 40-41: interrogatable and 
enabling modules, resources to enable (i.e. grant)control access to data)) 

Timson discloses wherein one or more data access controllers adapted to grant 
access to a corresponding portion of the electronic data based at least in part on a 
comparison, and associated with one or more data classes of the corresponding 
portion of the electronic data, (see Timson col. 2, lines 31-34; col. 2, lines 40-41 : 
interrogatable and enabling modules, resources to access and manipulate data; col. 
4, lines 7-11: access enabled (i.e. granted)) Timson does not specifically disclose a 
citizenship status, a current location of the access candidate and an existence of a 
data access agreement with a citizenship requirement, location requirement and 
data access agreement requirement. 
However, Orsini discloses: 

c) a citizenship status and a current location of the access candidate and an 
existence of a data access agreement with a citizenship requirement, location 
requirement and data access agreement requirement; (see Orsini paragraph 
[0013], lines 1-3; paragraph [0060], lines 4-13: management of secure data, 
parameters (i.e. attribute's) agreement, location information) 

d) a citizenship status and a current location of the access candidate with a 
citizenship requirement and a location requirement; (see Orsini paragraph 
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[0013], lines 1-3; paragraph [0060], lines 4-13: management of secure data, 
parameters (i.e. attributes) agreement, location information) 
It would have been obvious to one of ordinary skill in the art to modify Timson 
as taught by Orsini to enable at least one of: an indication an existence of a data 
access agreement with the access candidate; a current location of the access 
candidate; and a citizenship status of the access candidate. One of ordinary skill in 
the art would have been motivated to employ the teachings of Orsini in order to 
enable a relatively fast, secure, and efficient authentication of data streams, (see 
Orsini paragraph [0012], lines 1-3; paragraph [0013], lines 1-3) 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carlton Johnson whose telephone number is 571-270- 
1032. The examiner can normally be reached Monday through Friday from 8:00AM to 
5:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nassar Moazzami, can be reached on 571-272-4195. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
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information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-91 97 (toll-free). 



Cambn Johnson 
January 12, 2007 






